Do the protect accounts need to be in the local admin group?